Add uv publish: Basic upload with username/password or keyring

[konstin]

The uv publish command allows uploading wheels and source distributions to PyPI or another registry. We support username/password auth, token auth and (follow-up) trusted publishing from GitHub Actions. Be default we upload files from dist/*, the output directory from uv build.

This is intended to support three different workflow, ordered by relevance:

1. Publishing a pure Python package from CI

• Call uv build
• Clear the venv, install the wheel, run a smoke test
• Clear the venv, install the source distribution, run a smoke test
• Call uv publish

2. Publishing a native module package from CI

• In one job, call uv build, clear the venv, install the source distribution, run a smoke test, upload the source distribution as artifact
• For each target, run a job, call uv build --wheel, clear the venv, install the wheel run a smoke test, upload the wheel as artifact
• In a final job, download all artifacts to dist/* and run uv publish

3. Publishing from a developer machine

• Call uv build
• Do a manual test routine
• Call uv publish

Since we intend for smoke tests between build and publish, there is no combined build-and-publish command.

What works:

• Basic upload to PyPI with token or username/password (username must be __token__, but it uses the same HTTP headers)
• Uploads to gitlab.com (tested with a personal access token)
• Keyring integration. If you use scoped tokens, you need use url-string hacks such as Not obvious how to use multiple project API tokens with keyring pypa/twine#565 (comment) to differentiate the tokens, a problem we share with twine.
• Error messages
• Testing on CI. Every time something in the upload crate or its test script changes, we upload a new version of dummy packages to testpypi

This PR has coverage for PyPI (canonical index) and gitlab.com (alternative index). Unless there are concerns for a specific other index, I wouldn't add any specific testing for them yet.

Next PRs (all stacked on this one directly):

• Implement trusted publishing #7548
• Progress bars for uv publish #7613
• Add retries to uv publish #7635

Follow-ups:

• A demo repo with pure Python package that demonstrates scenario 1 in a copy&paste-able GitHub actions configuration. We can only demo this live once the feature shipped.

Not Implemented:

• Prompting for passwords.

Best reviewed commit-by-commit

[zanieb]

I have a test script for test PyPI for both username/password and keyring (next PR), but we need to run it in CI in a secure way.

Does it need to be secure? Or can we just have a test user that only uploads dummy packages that we can expose the password to?

[lucab]

Do you plan to try making parallel uploads here, or do you think that is not worth it?

[konstin]

Currently not planning to, but i made the upload async to make it easier to do in parallel (with other uploads or something else entirely) in the future.